Executive brief
The Price Drop Alert for WooCommerce plugin is a WordPress add-on used to notify customers about product price reductions in online stores. An attacker can inject malicious SQL commands through an unauthenticated AJAX request to extract sensitive data directly from the store's database, potentially exposing customer information, payment details, or other confidential business data without needing to log in.
Technical details
The plugin contains a SQL injection vulnerability (CWE-89) in an AJAX action that does not properly sanitize or escape user-supplied parameters before using them in database queries. The vulnerable endpoint is accessible to unauthenticated users, lowering the barrier to exploitation. An attacker can craft a malicious HTTP request containing SQL metacharacters in the product parameter to break out of the intended query and execute arbitrary SQL commands. This allows extraction of sensitive data from the WordPress database. No patch is currently available as of the advisory date.
Affected products
- WooThemes Price Drop Alert for WooCommerce through 1.1
Timeline
- 2026-09-18: disclosed
- 2026-09-16: advisory